don't allow UnrecognizedExtension with get_extension_for_class
diff --git a/src/cryptography/x509/extensions.py b/src/cryptography/x509/extensions.py
index 0c5b552..f7b5d7f 100644
--- a/src/cryptography/x509/extensions.py
+++ b/src/cryptography/x509/extensions.py
@@ -91,6 +91,13 @@
raise ExtensionNotFound("No {0} extension was found".format(oid), oid)
def get_extension_for_class(self, extclass):
+ if extclass is UnrecognizedExtension:
+ raise TypeError(
+ "UnrecognizedExtension can't be used with "
+ "get_extension_for_class because more than one instance of the"
+ " class may be present."
+ )
+
for ext in self:
if isinstance(ext.value, extclass):
return ext
diff --git a/tests/test_x509_ext.py b/tests/test_x509_ext.py
index 7c5ca5f..df796e0 100644
--- a/tests/test_x509_ext.py
+++ b/tests/test_x509_ext.py
@@ -1057,6 +1057,11 @@
exts.get_extension_for_class(x509.IssuerAlternativeName)
assert exc.value.oid == ExtensionOID.ISSUER_ALTERNATIVE_NAME
+ def test_unrecognized_extension_for_class(self):
+ exts = x509.Extensions([])
+ with pytest.raises(TypeError):
+ exts.get_extension_for_class(x509.UnrecognizedExtension)
+
def test_indexing(self, backend):
cert = _load_cert(
os.path.join("x509", "cryptography.io.pem"),